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Abstract — We explore the additional security obtained by 
noise at the physical layer in a wiretap channel model setting. 
Security enhancements at the physical layer have been proposed 
recently using a secrecy metric based on the degrees of freedom 
that an attacker has with respect to the sent ciphertext. Prior 
work focused on cases in which the wiretap channel could be 
modeled as statistically independent packet erasure channels for 
the legitimate receiver and an eavesdropper. In this paper, we 
go beyond the state-of-the-art by addressing correlated erasure 
events across the two communication channels. The resulting 
security enhancement is presented as a function of the correlation 
coefficient and the erasure probabilities for both channels. It is 
shown that security improvements are achievable by means of 
judicious physical-layer design even when the eavesdropper has 
a better channel than the legitimate receiver. The only case in 
which this assertion may not hold is when erasures are highly 
correlated across channels. However, we are able to prove that 
correlation cannot nullify the expected security enhancement if 
the channel quality of the legitimate receiver is strictly better 
than that of the eavesdropper. 

I. Introduction 

The origins of physical-layer security were laid down by 
Shannon |1| and Wyner [2| in seminal papers. Due to these 
works, and the contributions of others, it is known that channel 
codes exist that can achieve both reliability and security 
in relevant communication scenarios. The wiretap channel 
model presented in |2| is instrumental to this fact. Since 
that time, the goals of physical-layer security research have 
been twofold: first, to develop understanding of theoretical 
fundamental bounds on secrecy; and second, to design prac- 
tical codes which achieve the secrecy bounds (see ||3l and 
its references). Unfortunately, meeting theoretically-achievable 
secrecy bounds within a practical coding scheme often requires 
assumptions which may be unrealistic in practice. For exam- 
ple, some designs offer reliability to legitimate parties based 
on the premise that the main channel is noiseless |4|, [5 1. Other 
designs assume that the encoder has perfect channel state 
information (CSI) for friendly parties and malicious parties 
alike |6|. Finally, nearly every physical-layer security scheme 
cannot maintain secrecy when an eavesdropper has a consistent 
advantage in channel quality. 
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National Science Foundation (Grant NSF-0634952), the Luso-American 
Foundation (FLAD), the Funda^ao para a Ciencia e Tecnologia (FCT 
Scholarship SFRH/BD/6083 1/2009), and the WITS project (Grant 
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As a result, the point was made in fJ] that physical- 
layer security should be thought of as an extra layer of 
secrecy which can aid security efforts at other layers in the 
communications protocol stack. The coding scheme presented 
in 1 7 1, |8| was developed with the intent of avoiding unrealistic 
assumptions for practical application of a secrecy code which 
enhances security using stopping sets in punctured low-density 
parity-check (LDPC) codes. The added security was measured 
in the number of degrees of freedom D in an eavesdropper's 
information regarding the ciphertext, or equivalently in equiv- 
ocation |7|. The design is impervious to a lack of CSI, because 
it ensures that K[D] exceeds any fixed /? for nearly every 
possible combination of channel parameters as the dimension 
of the encoder increases. Thus, security enhancement occurs 
in the system even when an eavesdropper has a better channel 
than the legitimate receiver 

Despite the advantages of this scheme, as with other practi- 
cal designs, a simplifying assumption was made in the security 
analysis where erasure events for legitimate receivers and 
eavesdroppers were assumed to be statistically independent. 
However, in real radio environments, channels from a transmit- 
ter to different receivers may be correlated depending on the 
physical deployment of the receiver antennas, the availability 
of line-of-sight, and the presence or absence of scatterers at 
the transmitter and receivers ||9], llTOl . 

Therefore, we address the effects of correlation between 
packet erasures at an intended receiver and packet erasures 
at the eavesdropper on the performance of the physical-layer 
security design from [8|. The key contributions of this work 
are the following: 

• Security Analysis for Correlated Erasures: Using degrees 
of freedom in the eavesdropper's knowledge of the ci- 
phertext, the security analysis is made for the correlated 
packet erasure channel model. Comparisons are given 
between the correlated and uncorrected cases. 

• Correlation Coefficient Boundaries: Bounds on the cor- 
relation coefficient are derived, and analysis of security 
enhancement is provided assuming best and worst corre- 
lation conditions. 

• Security Enhancement: It is shown that in many cases 
security enhancement can still be obtained, even when 
the eavesdropper has a better channel than the legitimate 
receiver and erasures are correlated. We also prove that 
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Fig. 1. Wiretap cliannel model witli feedback assuming coiTelated packet 
erasures in the main cliannel Qm and the wiretap channel Qw 



correlation cannot reduce E[D] to zero if the legitimate 
receiver's channel quality is strictly better than that of the 
eavesdropper 

The rest of the paper proceeds as follows. In Section Ull we 
discuss the correlated wiretap channel model with feedback, 
and boundary properties of the correlation coefficient. We 
briefly discuss stopping sets, degrees of freedom as a security 
metric, and present the encoder and decoder from [8 | in 
Section |llll The security results for the correlated wiretap 
packet erasure channel model are given in Section |IV] and 
conclusions are provided in Section |V] 

II. Correlated Channel Model 

We consider the wiretap channel model with memoryless 
packet erasure channels (PEC), and add automatic repeat 
request (ARQ) for authenticated users as shown in Fig. [T] 
A user named Alice encodes an encrypted and compressed 
message M into a set of rj packets denoted X according to a 
specific encoding rule. The packets are then transmitted over 
the main channel Qm to an intended recipient named Bob who 
receives the set of packets Y where packet erasures occur with 
probability 6. Bob is permitted to request the retransmission of 
any missing packets using an authenticated feedback channel. 
After obtaining all transmitted packets, he applies the decoding 
rule and obtains an estimate of the secret message M. An 
eavesdropper named Eve also observes the transmitted packets, 
albeit through a different channel called the wiretap channel 
Qw Eve obtains the packets Z through Qw, by observing 
the initial transmission as well as any retransmitted packets. 
Erasures occur in this channel with probability e. She also 
attempts to decode the data and obtains an estimate of the 
secret message AI. 

Since and Q^ are memoryless, erasures occur inde- 
pendently with respect to one another in a given channel; 
however, erasures across channels are correlated with corre- 
lation coefficient p. Let E„i and be Bernoulli random 
variables which take on values in the set {0, 1}, where one 
signifies erasure and zero signifies error-free reception of a 
packet. Thus, Fi{Em = 1) = d and Pr(£;^, = 1) = e. The 
covariance of two random variables A and B is defined as 
cov{A, B) = E[(^ - E[A])(B - ^B])], and die variance of a 
random variable A can be expressed as var(A) = cov(A, A) 



031- Given these definitions, the Pearson correlation coeffi- 
cient between random variables Em and E^, is fTTl 
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The last step is made using the first and second moments of 
a Bernoulli random variable, where E[£',„] = E[£',^,J = 5 and 
¥.[Ew] = nEl] = e. Let p,, = Pv{Em = i^E^ = j) [12\. 
Then, S = pio +pii = E[Em] and e = poi +Pii = E[Ew]- It 
is trivial to show that E[EmEw] is equal to Pr(i?m = 1, E^ — 
1). Thus, ([T]i can be expressed as 

Pii - Se 



P = 



(2) 



V<S(1 - <5)e(l - e) 

The Pearson correlation coefficient is commonly used to 
indicate the degree to which two random variables are similar. 
Although \p\ < 1, it is a common misconception that p can 
take on any value from —1 to +1. In reality, there are bounds 
to the coefficient which are a function of the distribution of the 
random variables involved [13|. In our case, we have allowed 
5 and e to take on any value in [0, 1]. We also know that 
S = Pii +Pio, e = Pii +Pm, and poo +Poi +Pw+Pii = 1- 
Since pij > for i,j e {0, 1}, then 

max((5 + e — 1, 0) < pn < mm{S, e). (3) 

The bounds on pn can be given as bounds on p as 



max((5 + e — 1,0) — Se 
^Se{l-S){l-e) 



<P< 



min((5, e) — 5e 
VSe{l-S)il-: 



(4) 



For example, if S = 0.3 and e — 0.15, then —0.275 < p < 
0.642. 

III. Encoder and Decoder Design 

The goal of the security sub-system from (|8] is to inflict Eve 
with stopping sets in her received codewords, thus forcing her 
to guess the values of D bits in the decoder. Even a single 
error in the guess is magnified so the ciphertext has bit-error 
rate 0.5. Block diagrams of the encoder and decoder are given 
in Figs J2] and [3] We now provide a brief explanation of the 
systemic 

A. Stopping Sets 

Consider the message-passing (MP) decoder of an LDPC 
code C ll4i over the binary erasure channel (BEC). It helps 
to think of the N — k x N parity check matrix H, along 
with its Tanner graph representation. Let V — {vi,V2, ■ ■ ■ ,vn) 
be a set of vertices called variable nodes. Also let U = 
{ui,U2, ■ ■ ■ ,UN-k) be a set of vertices called check nodes. 
Finally let Gc be the Tanner graph representation of H, where 
Gc is bipartite with bipartitions V and U. An edge connects 

'For further details, the reader is referred to and ||8]. 
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Ui with Vj if and only if Hij = 1. Then all variable nodes 
connected to a particular check node form a checksum which 
is satisfied for all valid codewords in C. 

Definition 1 (Di, et. al. ifTSl ). A stopping set is a set A C 
such that all check nodes in A^(A) are connected to A by at 
least two edges, where N{A) signifies the neighborhood of A 
and is defined as the set of all adjacent nodes to A in Gc- 

Since by definition, the empty set is also a stopping set, each 
set of variable nodes has a maximal stopping set in it. If the 
standard MP decoder over the BEC is applied to a codeword 
where bits corresponding to V C V are erased, then the set 
of unknown bits after decoding is the maximal stopping set in 

v m. 

B. Encoder 

An encrypted and compressed message M is grouped 
into L blocks of length k. Allow the final block to be 
completed with random bits if necessary. Specifically, M — 
(m^, m^, . . . , m^) where m' — {m\,m\, . . . , m\). Since M 
is compressed, the bits of the message are such that each block 
takes on one of 2^ possible bit patterns uniformly at random. 

Each is then channel coded using a nonsystematic LDPC 
code. This encoding is done in two steps. First, the ith fc-bit 
message block to' is scrambled using a k x k matrix S for 
i = 1,2,...,L. The scrambler S is formed by generating 
random k x k binary matrices until one is found for which 
an inverse exists in GF(2). S^^ is calculated using the LU 
factorization tailored to GF(2). The scrambling operation is 
a* = to' 5. This yields a set of L scrambled blocks A, each 
of size k. The scrambler is followed by a systematic {N, k) 
LDPC encoding using the kx N generator matrix G of a code 

C. The output codewords are then fe* = a^G. There are L of 
them, and each has length N. 

The LDPC code in the encoder must meet certain criteria. It 
was shown in |8| that a set of coded bits R can be punctured 
from a codeword in G such that the maximal stopping set in 
R is the empty set, and the maximal stopping set in i? + w is 
nonempty Vw ^ i?. If a nonempty stopping set exists in the 
set of erasures in a given codeword, then there also exists a 
minimum-sized set of bits which must be guessed in order to 
allow the MP decoder to completely solve for the codeword. 
The size of this minimum-sized set is the number of degrees of 
freedom D. We require the code used by this encoder to have 
an associating R such that \R\ = N — k. The reason for such 
a choice is tied to a relationship between MP and maximum- 
likelihood (ML) decoders. It is shown in [Tj Lemma 3] that 



under such encoder constraints Dml = Dmp = \Rc\, i-C- the 
number of degrees of freedom in the ML decoder and MP 
decoder are equal, and equivalent to the number of channel 
erased bits \Rc\- Thus, although the MP decoder is known to 
be suboptimal to the ML decoder, when \R\ = N — k the two 
provide the same performance. A random algorithm for finding 
such an R was given in |8|, and irregular degree distributions 
have been found which return puncturing patterns of this 
nature with reasonable probability |)7]. Each codeword in the 
set of output codewords B = (6^, 6^, . . . , 6^) is punctured 
according to R to form the set of punctured codewords 
P = ■■■,P^) where each = {p\,pI, ■ ■ ■ ,p\)- Since 

each punctured codeword has blocklength n, the effective rate 
of this encoder is k/n. 

Finally, these punctured codewords are distributed amongst 
rj packets in an interleaver denoted 11 so that a bits from all 
L codewords are in each packet. The set of packets is denoted 
X — (.x^, x^. . . . , a;''), and each packet has length aL. 
Thus, n — Tyall Note that the interleaver 11 which spreads 
a bits from each punctured codeword into each packet, also 
yields equality in D across codewords (see [[Tj Corollary 1]). 

C. Decoder 

The decoder consists of the following pieces: a buffer ca- 
pable of holding all received data packets Y, a deinterleaving 
function 11"^ which inverts the interleaving in the encoder 
to yield the punctured codewords P, the standard MP decoder 
with output codewords B of which the systematic bits form the 
scrambled message blocks A, and finally the descrambler 5*"^ 
which supplies an estimate of the compressed ciphertext M 
as TO* = a'S""^. Notice that these collections of packets and 
codewords describe Bob's decoder. Eve's decoder is similar, 
except we denote the received data packets as Z, and then P, 
A, 13, and M form the eavesdroppers respective estimates of 
P, A, B, and M. 

IV. Security for Correlated Channels 

The security results for the correlated channel model from 
Section HI] are presented and compared with results given in 
|7| and [8l for the independent channel case. We assume that 
the degree distribution for the LDPC code and the puncturing 
pattern R are chosen such that = A^ — k. Thus, the MP 
decoder achieves the ML performance, and furthermore, D is 
equivalent for each decoded codeword. 

-It is assumed that a divides n for ease of notation. 



A. Main Security Results 

The first result is the distribution on D. 



that for statistically independent Q,„ and 

Pr(i?e/) ^ ' 



Lemma 1. Assume the encoder specified in Section \III-B\ 
where \R\ = N — k. If Q,n and are memoryless, and 
erasures in the two channels are correlated, then the random 
variable D which takes on the degrees of freedom in a received 
codeword is a scaled binomial random variable. Thus, for 
1 < /3 < a-q, 

Prp>/3) = 1- E r (l-Pr(i?e/)rPr(i?e/)''-' 

(5) 

where Ref is the event that a particular packet is received 
error-free by Eve. 

Proof: The proof is identical to that for Lemma 4 in Q, 
because although erasures in Qm and Q^, are correlated, each 
packet is received error-free by Eve independent from other 
packets. This allows each transmitted packet to be considered 
a Bernoulli experiment as to whether Eve receives the packet. 
The sum of the missing packets is binomial with success 
parameter 1 — Pi{Ref). The distribution in (|5]l follows. ■ 
Another result which was found to apply to the indepen- 
dent erasure case in |7| follows directly from Lemma [T] for 
correlated erasures as well. 

Theorem 1. If \R\ = N — k in the encoder, then k/n ~ 1, 
and 

E[D] = H{X\Z) = (1 - Pr(i?e/))n = (1 - Pr(i?e/))fc. (6) 

Proof: Since \R\ ^ N ~ k, then n ^ \Q\ ^ N - \R\ ^ 
k. Let us consider the model for a single codeword (L — 
1). We can then assume rj independent uses of a PEC with 
packets of length a. Let X — {x^,x'^, . . . ^x"^) be the input 
to the channel, and Z = {z^, z^, . . . , z**) be the output, where 
a bits are erased with probability 1 — Pr(i?e/) or received 
error-free with probability Pr(i?e/) with each channel use. 
The input distribution on a bits is uniform because the input 
distribution on M is uniform, and the encoding function of 
rate one forms a bijection on k bits. Thus, H{x^) — a for i — 
1, 2, . . . , ?7. It can be shown that H{z'\x^) = H(l -Pr(i?e/)), 
and H{z') = H{1 - Pr(i?e/)) + Pr(i?e/)Q; (see lEl, Pg- 
188). Then, H{x'\z') = H{z'\x') - H{z') + H{x') = a(l - 
Pr(i?e/)). Therefore, with 77 independent uses of the channel 
(one for each packet), H{X\Z) = (1 - Pr(i?e/))?7a (1 - 
Pi{Ref))n. Since the mean of a binomial random variable is 
the product of its two parameters, E[D/a] = (1 — Pr{Ref))ri, 
which concludes the proof. ■ 
The remaining necessary task to characterize D is to solve 
for Pr(i?e/) when erasures in Qm and are correlated with 
correlation coefficient p. If such an expression reverts back to 
the independent case when p — 0, then as long as erasures are 
uncorrected, and Qm and Qw are memoryless, the previous 
result for independent erasures applies. It was shown in [8 | 



1 — eo 

Lemma 2. In the wiretap channel scenario with feedback, if 
channel erasures are correlated events across Qm and Qw 
with correlation coefficient p, then the probability that Eve 
obtains a single transmitted packet error-free is given as 

Pr{Ref) - ^ =. (8) 

^ l-e6- p^Se{l-6){l-e) 

Proof: Let W be the total number of times that Bob 
requests a single packet over Q„i before he obtains it error- 
free. Since Q.,„ is memoryless, the packet is erased each time 
independently with probability 5. Therefore, W is a random 
variable which takes on the number of total transmissions up 
to and including the first successful reception of the packet, 
and is thus geometrically distributed with success parameter 
1 - S. Then, Pr (W^ = j) = (1 - S)S^-^ [llj. Let E'^ and 
i?^ denote the respective erasure outcomes in Q„i and 
for the zth retransmission of the packet, where a one signifies 
an erased packet as before. Therefore, 
00 

Pr(i?e/) = Y.PT{Ref\W ^ j)PT{W = j) 

00 

= Y,i^-Pr{El = ---=Ei = l\El = --- 

^JJ^,-' = l,Ei, = 0)PiiW = j) 
^Pii\^^^ Poi 
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Pii 



1 -pii -poi 

1 -Pll 




Now since pu = py^ Se{l — 5){1 — e) + Se and poi — 
p^Se{l - S){1 - e) + e{l - S), then 

1 - e 

Pl(Ref) = =. 

■ 

Clearly, this reduces to the independent case in (|7) when 
p — 0. Fig. |4] gives an example of Pr(_D > /3) using this 
expression for Pr(i?e/) where (3 is chosen to be 50. The figure 
assumes C to be rate-1/2 with blocklength N = 10000, \R\ = 
N - k = 5000, and a = L Therefore, 7] ^ n/a = 5000. 
We set S ~ 0.5 and plot different e values as p takes on all 
possible values indicated by the bounds in (01). Fig. |4] implies 
the existence of a correlation threshold pth for Pr(£' > /?), in 
that if all other parameters are set, then for p < pth, Pr(I? > 
/?) w L Yet, for p > pth, Pr{D < (3) is essentially one. 
Notice, however, that when e = 0.51, Pr{D > 50) sa IVp. 
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Fig. 4. Pr(D > 50) when the number of packets rj = 5000, a = 1, and 
Bob's erasure probabihty 5 = 0.5. Results are plotted for varying erasure 
probabilities e for Eve's channel as a function of the con'elation coefficient p. 



B. Security at the Correlation Bounds 

Now that we understand how correlation affects the random 
variable D, we evaluate the extreme cases in correlation 
coefficients by considering the bounds on p in (|4|l. 

Consider the lower bound p = ■ Then, 



Pr(i?e/) 



1 



1 -max((5 + e- 1,0) 



Therefore, 



Pr(i?e/) 



1 -e 



if (5 + e > 1 
otherwise 



(9) 



(10) 



If S+e > 1, this implies that Pr(i?e/) > 1 — e, which of course 
is worse for secrecy than if (5 + e < 1, all other things being 
equal. When S + e < 1, Pr(i?ey ) — 1 — e implies that negative 
correlation can reduce the eavesdropper to an effective erasure 
channel where only one chance is given to intercept each 
packet, despite retransmission of some packets. Of course, 
the reasoning behind this is that this minimum correlation 
indicates that all of Eve's missing packets are obtained by 
Bob in the first transmission with probability one. 



Now consider the upper bound p 



min((5,e) — i5e 

^5e(l-V)(l-e) 



1 



1 — min((5, e) ' 



. Then, 



(11) 



which then implies that when Eve has at least as good of a 
channel as Bob, i.e. 6 > e, that the upper bound yields perfect 
correlation, that is every packet is eventually received by Eve 
error-free. However, if Bob can maintain a channel advantage 
over Eve, i.e. S < e, then we see that Pr(i?e/) = < 1. 
Thus, even maximum correlation cannot reduce E[D] to zero. 
Since K[D] grows with k in (|6]), this indicates that we can still 
gain as many degrees of freedom as we desire on average by 
increasing the dimension of the encoder. 



V. Conclusions 

In conclusion, we have analyzed the secrecy coding and 
ARQ scheme from [ISl for correlated packet erasures in 
the main and wiretap channels. Security results have been 
compared with the results previously known for independent 
erasures in the two channels. Furthermore, the overall se- 
crecy effect of correlation is maximized when p takes on 
its minimum value resulting in only one opportunity for an 
eavesdropper to obtain every packet. The minimum security 
due to correlation occurs at the upper bound of the correlation 
coefficient, and can reduce the degrees of freedom to zero, 
although if Bob can maintain even the slightest advantage in 
overall channel quality, the degrees of freedom cannot go to 
zero, and can be set arbitrarily by changing the dimension of 
the encoder k. Thus, the physical-layer coding scheme retains 
its security enhancement features in spite of correlation across 
erasure channels. 
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